Unable to load the Anti-Rootkit DDA Driver

[danmcb]

Hello,

Yesterday I did a clean uninstall/reinstall because of occasional "error 20025" messages I have been getting. Everything seemed fine.  But this morning when I boot, I get this : (see attached screenshot).

I immediately ran (before reboot) the Farbar scan, logs attached. When I went for the reboot, I had a 20023 error before the shutdown, and 20025 on restart. It then went into a full scan (without rootkit detection I think) before I was able to log in again. Now I am logged in, everything seems normal, and rootkit detection is enabled in MWB.

 

Please advise my next steps. Many thanks.

Addition.txt

FRST.txt

[AdvancedSetup]

Please download Malwarebytes Anti-Rootkit from HERE
If needed there is a self help tutorial here: MBAR tutorial

• Unzip the contents to a folder in a convenient location.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
• Wait while the system shuts down and the cleanup process is performed.
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
• When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt
  

[danmcb]

thank you. I will do this immediately. will get back when it is done.

[AdvancedSetup]

Sounds good, thanks

 

[danmcb]

when I try to run MBAR I get a message that Anti-Rootkit Beta is already running (probably because I have rootkit protection turned on in the MBAR app itself). What is best here? turn off in main app? reboot?

[AdvancedSetup]

Yes, Please turn off Self Protection and load with Windows for MBAM. Then restart the computer and try MBAR again please.

 

[danmcb]

The scan completed, it said "no cleanup required" so I guess I am all clear, Doc? (system-log attached anyway)

system-log.txt

[AdvancedSetup]

Please go ahead and run through the following steps and post back the logs when ready. We'll see if there is something else there that is interfering with MBAM.

STEP 04
Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next reply message
• When completed make sure to re-enable your antivirus

STEP 05
Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista / Windows 7/8 users right-click and select Run As Administrator
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• When it's done you'll see: Pending: Please uncheck elements you don't want removed.
• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• Look over the log especially under Files/Folders for any program you want to save.
• If there's a program you may want to save, just uncheck it from AdwCleaner.
• If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
• If you're ready to clean it all up.....click the Clean button.
• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.
• Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
• To restore an item that has been deleted:
• Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

STEP 06


Please go here to run the online antivirus scannner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked
• Click on Advanced Settings and ensure these options are ticked:
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Click Scan
• Wait for the scan to finish
• If any threats were found, click the 'List of found threats' , then click Export to text file....
• Save it to your desktop, then please copy and paste that log as a reply to this topic.

STEP 07
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

[danmcb]

OK. I am part of the way through this.

 

1. JRT ran OK. Log attached.

2. ADWCleaner ran.  Logs attached (it has run at some time in past)

3. EST was running when I went to bed. At that time it had found 6 threats. Curiously some parts of the window were blacked out. When i woke,

the PC had gone in sleep mode - didn't think of that - should have turned that off of course. When I resumed,  EST was still there - but the window was totally black,  so no way to find out what it found.

 

Try re-running it with sleep mode off?

JRT.txt

AdwCleaner[C1].txt

AdwCleaner[S1].txt

[AdvancedSetup]

Let's bypass the ESET scan for now. Please run a new MBAM threat scan and the FRST logs.

Thanks

 

 

[danmcb]

OK, thanks for fast reply. I am gonna reboot first as the EST app is still running although I can't do anything with it. OK?

[AdvancedSetup]

Yes, no problem.
I'll check back again in a few

 

[danmcb]

OK, all done. First reboot, then :

1. MBAM scan did not appear to find anything - log attached

2. FBAR fresh download and scan - logs attached.

There is something pretty odd about what happened with ESET. I checked, my laptop is set NOT to sleep or kill the display when on mains power, which it is. But the ESET can seems to have gone to "sleep" at some  point in the night, after having claimed to have found 6 threats.

Actually what happened was that in the morning the machine looked as if it was powered down. I hit the power button, initially I got a black screen with just a flashing text-mode cursor. Nothing appeared to be happening so I hit the power key again, and then I got "resuming windows", logged in to my account,  and the desktop with the empty ESET window. I could drag the window around the screen, but it was doing very odd things to the display.

I am very curious about what ESET found ...

Many thanks for your help in this, Ron.

mbam-log.txt

Addition.txt

FRST.txt

[AdvancedSetup]

It's possible the built-in OEM power management took over and put it to sleep instead of Windows.

HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4367808 2009-12-17] (Lenovo(beijing) Limited)

 

Please go into Control Panel, Add/Remove and uninstall ALL versions of Java and then run the following.
 
Please download JavaRa-1.16 and save it to your computer.

• Double click to open the zip file and then select all and choose Copy.
• Create a new folder on your Desktop named RemoveJava and paste the files into this new folder.
• Quit all browsers and other running applications.
• Right-click on JavaRa.exe in RemoveJava folder and choose Run as administrator to start the program.
• From the drop-down menu, choose English and click on Select.
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
• A logfile will pop up. Please save it to a convenient location and post it in your next reply.
  

Next:
 
Please Run TFC by OldTimer to clear temporary files:

• Download TFC from here and save it to your desktop.
• http://oldtimer.geekstogo.com/TFC.exe
• Close any open programs and Internet browsers.
• Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
• Please be patient as clearing out temp files may take a while.
• Once it completes you may be prompted to restart your computer, please do so.
• Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.
  

 

Next,

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

 

Thanks

[danmcb]

That all looked good. There was no need of a reboot after running TFC (i will keep that for regular use later!)

How are we doing?

JavaRa.log

Fixlog.txt

[danmcb]

(By the way when this is done, this looks like a good moment to uninstall a whole load of stuff I no longer use, and defrag ... but I will wait until  this process is complete. If you guys think ESEP is a good AV, I might by a paid version and use instead of MSE - I have a few android devices that also need protection. I very much appreciate the expert advice. Thanks.)

[AdvancedSetup]

The logs look pretty good. How is the computer running now. Any issues with MBAM anymore?

Not sure what you mean by ESEP antivirus.

Norton, Kaspersky, Trend, ESET are all pretty good antivirus programs. I use Norton on my wife's computer with MBAM and she's been clean now for years.

 

 

[danmcb]

No, everything seems to be running well now. I meant ESET, sorry. Thank you very much for helping me out here, Ron. All the best!

[AdvancedSetup]

You're very welcome.

 

At this time there are no more signs of an infection on your system.
However if you are still seeing any signs of an infection please let me know.

Let's go ahead and remove the tools and logs we've used during this process.

Most of the tools used are potentially dangerous to use unsupervised or if ran at the wrong time.
They are often updated daily so if you went to use them again in the future they would be outdated anyways.

The following procedures will implement some cleanup procedures to remove these tools.
 
Download Delfix from here and save it to your desktop. (you may already have this)

• Ensure Remove disinfection tools is checked.
• Click the Run button.
• Reboot
  

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

 
If there are any other left over Folders, Files, Logs then you can delete them on your own.
 
Please visit the following link to see how to delete old System Restore Points. Please delete all of them and create a new one at this time.
How to Delete System Protection Restore Points in Windows 7 and Windows 8

Remove all but the most recent Restore Point on Windows XP

As Java seems to get exploited on a regular basis I advise not using Java if possible but to at least disable java in your web browsers
How do I disable Java in my web browser? - Disable Java

A lot of reading here but if you take the time to read a bit of it you'll see why/how infections and general damage are so easily inflicted on the computer. There is also advice on how to prevent it and keep the system working well. Don't forget about good, solid backups of your data to an external drive that is not connected except when backing up your data. If you leave a backup drive connected and you do get infected it can easily damage, encrypt, delete, or corrupt your backups as well and then you'd lose all data.
Nothing is 100% bulletproof but with a little bit of education you can certainly swing things in your favor.

• How Malware Spreads - How did I get infected
• Best Practices for Safe Computing - Prevention of Malware Infection
• Avoiding those unwanted free applications
• A close look at how Oracle installs deceptive software with Java updates
• IAC / Ask.com toolbars
• Malwarebytes Unpacked Blog
  

If you're not currently using Malwarebytes Premium then you may want to consider purchasing the product which can also help greatly reduce the risk of a future infection.

 

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!